Solved Why can't I truss pid 1

Perhaps a silly question, but the subject says it all.

Output example (as root):
truss: can not attach to target process: Invalid argument

on: FreeBSD freebsd-virtual 11.1-RELEASE-p8 FreeBSD 11.1-RELEASE-p8 #0: Tue Mar 13 17:07:05 UTC 2018 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64

Yet, I can do it on Solaris. Not sure about Linux, but that's irrelevant.

Cheers,
Mark
 
Interesting...never considered the NEED to truss the init process. I'd have to think about how truss works, but I'd "guess" it reassigns the target process to a process group owned by truss command, which I'd also guess might be verboten, since init is suppose to be the God of processes. I could be 180 degrees off, but that's my guess without investigation.

Oops...Read the last sentence of below. I think that covers why it doesn't work.

The truss utility traces the system calls called by the specified process
or program. Output is to the specified output file, or standard error by
default. It does this by stopping and restarting the process being
monitored via ptrace(2).

Since you cannot "stop" the init process...
 
Back
Top